auth-review

What problem does it solve?

This Skill helps security engineers review authentication and authorization design across codebases to identify weaknesses in token handling, session management, and access controls.

Core Features & Use Cases

• Identify authentication mechanisms (JWT, OAuth, API keys) and how they are integrated.
• Map token issuance, validation, and refresh flows; check for expiration handling and TTLs.
• Assess authorization models (RBAC/ABAC) and ensure centralized checks; flag ad-hoc comparisons.
• Detect potential privilege escalation risks and IDORs; review CSRF and cookie security settings.
• Provide remediation guidance and prioritized risk mitigation for secure design.

Quick Start

Run a security review focusing on the auth layer by scanning for token lifetimes, session cookies, and authorization checks. Generate a concise report with findings and recommended mitigations.